root-cause-investigation

name	root-cause-investigation
description	Five Whys root-cause investigation: ask why iteratively until reaching an actionable, systemic root cause. Includes an analysis template, corrective-action framing, and anti-patterns (blame, stopping at symptoms). Trigger keywords: root cause, five whys, post-mortem, why did this happen, process failure.
license	MIT
metadata	{"version":"3.1.0","hermes":{"tags":["Diagnostics","Root-cause","Methodology","Problem-solving"],"related_skills":["first-principles-debugger","bottleneck-identifier"]}}

Root Cause Investigation

Five Whys

Ask "Why?" iteratively until reaching an actionable root cause. Five is a heuristic — stop when actionable. Fewer than 5 often stays at symptom level.

Branch when a "Why" has more than one answer. Five Whys' classic failure is forcing a single linear chain onto a multi-causal incident — the outage had a missing CI check AND a missing alert, and a single chain ships one fix while the other cause recurs. When an answer has multiple genuine contributors, split into parallel chains and drive each to its own root cause.

"Actionable" = names a systemic change you can make, not a person to remind or a symptom to patch. "The dev forgot the index" is not actionable-root (it's a person); "no migration check in CI" is. If your answer is a who or a one-off patch, keep asking.

Verify each link and the fix. Each "why X caused Y" is a claim — confirm it against evidence (logs, metrics) before building on it; a wrong mid-chain link routes to a wrong root cause. After shipping the corrective action, re-measure that the failure actually stopped recurring — an unverified fix on a misidentified cause looks done and isn't.

## 5 Whys Analysis: [Problem]

**Problem Statement**: [What went wrong]

| Why # | Question | Answer |
|-------|----------|--------|
| 1 | Why did [problem] happen? | [Symptom] |
| 2 | Why did [answer 1] happen? | [Proximate cause] |
| 3 | Why did [answer 2] happen? | [Contributing factor] |
| 4 | Why did [answer 3] happen? | [Systemic issue] |
| 5 | Why did [answer 4] happen? | **[ROOT CAUSE]** |

**Corrective Action**: [Prevents recurrence]
**Wrong Fix** (treats symptom): [What NOT to do]

Example: Page slow → full table scan → missing index → migration failed silently → no migration check in CI → Add migration check.

Rules

• Ask "Why did the system allow that mistake?" not "Who made the mistake?"
• "Communication breakdown" is never specific enough — what exactly wasn't communicated?
• Don't stop too early — "We don't have budget" is rarely root cause
• Label inferred root causes as [Inference] until verified